CVE-2010-4278

published 2010-12-02

CVE-2010-4278: operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the…

Priority P2 59 critical 9 CVSS 2.0

AV N AC L Au S C C I C A C

EXPLOIT

operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layout parameter in an operation/agentes/networkmap action to index.php.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
artica	pandora_fms	<= 3.1	—
artica	pandora_fms	—	—
artica	pandora_fms	—	—
artica	pandora_fms	—	—
artica	pandora_fms	—	—
artica	pandora_fms	—	—
artica	pandora_fms	—	—
artica	pandora_fms	—	—
artica	pandora_fms	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://servername/pandora_console/index.php?login=1&login=1&sec=estado&sec2=operation/agentes/networkmap&refr=0&layout=1;uname%20-a;↗

url http://servername/pandora_console/index.php?login=1&sec=estado&sec2=operation/agentes/networkmap&refr=0&layout=1;id;↗

path operation/agentes/networkmap.php↗

command layout=1;uname -a;↗

• → Monitor HTTP requests to index.php where the `sec2` parameter equals `operation/agentes/networkmap` and the `layout` parameter contains shell metacharacters (e.g., semicolons, pipes, backticks). ↗
• → Alert on URL-encoded shell metacharacters (e.g., %3B for `;`) in the `layout` query parameter of requests targeting `/pandora_console/index.php`. ↗
• → The vulnerable sink is a `system()` call in networkmap.php where the unsanitized `layout` value is interpolated directly into a shell command string (`$cmd`). Look for anomalous child processes spawned by the web server process originating from this file. ↗

• · Exploitation requires the attacker to be authenticated; however, a separate authentication bypass vulnerability (referenced in the same advisory) can be chained to achieve unauthenticated RCE, raising the effective CVSS to 10/10. ↗
• · All Pandora FMS versions up to and including 3.1 are affected; version 3.1.1 and the official 3.1 security patch (released October 2010) contain the fix. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78